About this reference

What this reference covers, which build it describes, how the facts were established and how to read addresses and layouts.

What it covers

This reference describes how Middle-earth: Shadow of War works inside: the layout of its executable, the engine objects that run the game, how it streams and stores data, the world format, scripting, rendering, effects, audio, animation and physics, and the gameplay systems built on top of them (AI, combat, items, the Nemesis system, quests, user interface and saves).

The engine is Monolith Productions' in-house engine; the build paths left in the executable name the project Kraken (proj\Kraken\code\...). It builds on Havok 2016.2.0-r1 (hk2016_2_0_r1) for physics, AI navigation, cloth and scripting (HavokScript), Wwise for audio, Bink 2 for video and Scaleform GFx 4.5 for the user interface.

Which build

Everything here describes the Steam release, game version 1.21 (ShadowOfWar.exe, 117,732,784 bytes, linked in August 2018). Addresses will differ on any other build.

How the facts were established

• Static analysis of the executable: a full instruction decode of every function, cross references, vtables and run-time type information, string references, the exception-unwind tables and the C runtime's initializer tables.
• Inspection of the running game: reading live objects, containers and engine state, with a control for every census (a known-good object or a deliberately wrong value checked in the same pass), and comparing values decoded from the shipped files with the values the engine holds.
• Parsing the shipped archives: every container format and data format the game reads, decoded until every byte of a format is accounted for and the decode matches what the running game loaded.
• Thread sampling: suspending one thread at a time, unwinding its stack with the executable's own unwind data, and aggregating thousands of samples into call trees and per-frame order.
• Emulation: running individual engine functions in an emulator against a snapshot of live memory, to see exactly what they read and decide.

Numbers such as "950 of 950" are the measurements a statement rests on: how many cases were checked and how many agreed.

Reading addresses

• The executable has no relocation table, so it always loads at 0x140000000. Code and static data addresses are given as offsets from that base (RVAs): 0x1A864C is the address 0x140000000 + 0x1A864C = 0x1401A864C.
• [base+0x26FFAA8] means "the pointer stored at RVA 0x26FFAA8". [GM+0x6C68] means "the pointer stored 0x6C68 bytes into the object GM".
• Heap addresses change every run and are never given.
• vt_0x1F68920 names a class by its vtable's RVA when the class has no recoverable name; vf10 is the vtable's eleventh slot (counting from 0).
• GameDB records and categories are written in backticks with their category path, for example Character/Models.

Open questions

Each chapter ends with the questions that are still open, phrased with what would settle them.

Shadow of War (Steam), game version 1.21. An unofficial fan research project, not affiliated with or endorsed by Warner Bros. Games, Monolith Productions or Middle-earth Enterprises. Middle-earth: Shadow of War belongs to its owners.